spinuptui 0.25.0 → 0.26.1

package/src/lib/cliPull.ts

@@ -0,0 +1,387 @@
+// `spinuptui pull files` / `spinuptui pull db` — the two local-working-copy
+// engines, driven non-interactively.
+//
+// Same engines the TUI drives (lib/localSetup.ts and lib/dbSync.ts), same
+// domain resolution as `ssh`/`ssh-exec` (lib/cliSsh.ts's resolveSiteByDomain),
+// so behavior can't drift between the two front ends. Nothing here reimplements
+// a step; this file is argument resolution, gating, and result shaping.
+//
+// Output contract, matching the other subcommands: the returned object is the
+// machine-readable result (one JSON object on stdout under --json, exit code
+// mirrors `ok`). Progress goes to the caller's `onStage` — stderr, always,
+// human-readable — so a person watching a ten-minute rsync can see it isn't
+// hung and an agent still has the trail when something fails.
+//
+// `pull files` is read-only on production. `pull db` OVERWRITES the local
+// database, so it's gated twice: the `localSync` config opt-in (same gate the
+// TUI enforces) and an explicit `--yes` on the invocation. Both are checked
+// before any network call, so a typo'd domain in a script fails on the gate.
+
+import { existsSync } from "node:fs"
+import { join } from "node:path"
+import { configPath, type AppConfig } from "../config.ts"
+import type { SpinupWPClientLike } from "../api/client.ts"
+import { resolveSiteByDomain, type SshAccessCandidate, type SshAccessReason } from "./cliSsh.ts"
+import { planLocalSetup, runLocalSetup, type LocalSetupStage } from "./localSetup.ts"
+import { planDbSync, runDbSync, type DbSyncStage } from "./dbSync.ts"
+import { readLink, writeLink } from "./links.ts"
+import { expandPath } from "./local.ts"
+
+export type PullReason =
+  | SshAccessReason
+  | "no_dest"
+  | "ambiguous_dest"
+  | "already_linked"
+  | "dest_not_empty"
+  | "plan_failed"
+  | "fetch_failed"
+  | "composer_failed"
+  | "not_linked"
+  | "missing_env"
+  | "local_sync_disabled"
+  | "not_confirmed"
+  | "sync_failed"
+
+export type PullCommand = "pull files" | "pull db"
+
+export interface PullFailure {
+  ok: false
+  command: PullCommand
+  domain: string
+  reason: PullReason
+  message: string
+  remedy?: string
+  candidates?: SshAccessCandidate[]
+  failedStage?: string
+}
+
+export interface PullFilesSuccess {
+  ok: true
+  command: "pull files"
+  domain: string
+  primaryDomain: string
+  path: string
+  localUrl: string
+  method: "git" | "rsync"
+  ranComposer: boolean
+  linked: true
+  // Non-fatal caveats about the copy that just landed — most importantly the
+  // things standing between it and a working `pull db`.
+  warnings?: string[]
+}
+
+export interface PullDbSuccess {
+  ok: true
+  command: "pull db"
+  domain: string
+  primaryDomain: string
+  path: string
+  localUrl: string
+  downloadPath: string
+  localBackupPath: string
+  ranHook: boolean
+  warnings?: string[]
+}
+
+export type PullFilesResult = PullFilesSuccess | PullFailure
+export type PullDbResult = PullDbSuccess | PullFailure
+
+export type StageReporter = (line: string) => void
+
+const FILES_STAGE_LABELS: Record<LocalSetupStage, string> = {
+  fetch: "Getting the code down",
+  build: "composer install",
+  done: "Done",
+  error: "Failed",
+}
+
+const DB_STAGE_LABELS: Record<DbSyncStage, string> = {
+  "local-backup": "Backing up the local database first",
+  export: "Exporting the production database",
+  download: "Downloading the dump",
+  import: "Importing into the local database",
+  replace: "Rewriting production URLs to local",
+  hook: "Running bin/sync.d/post-import.sh",
+  done: "Done",
+  error: "Failed",
+}
+
+// Shape a resolver failure (unknown domain, ambiguous domain, dead token, …)
+// into this command's result type, preserving the shared reason codes.
+function fromResolverFailure(command: PullCommand, failure: { ok: false } & Record<string, unknown>): PullFailure {
+  const candidates = failure.candidates as SshAccessCandidate[] | undefined
+  const remedy = failure.remedy != null ? String(failure.remedy) : undefined
+  return {
+    ok: false,
+    command,
+    domain: String(failure.domain ?? ""),
+    reason: failure.reason as PullReason,
+    message: String(failure.message ?? ""),
+    ...(remedy ? { remedy } : {}),
+    ...(candidates ? { candidates } : {}),
+  }
+}
+
+export async function runPullFiles(
+  domain: string,
+  opts: { path?: string | null; url?: string | null; server?: string | null },
+  client: SpinupWPClientLike,
+  cfg: AppConfig,
+  onStage: StageReporter,
+): Promise<PullFilesResult> {
+  const command: PullCommand = "pull files"
+  const fail = (reason: PullReason, message: string, remedy?: string): PullFailure => ({
+    ok: false,
+    command,
+    domain,
+    reason,
+    message,
+    ...(remedy ? { remedy } : {}),
+  })
+
+  onStage(`Resolving ${domain} …`)
+  const resolved = await resolveSiteByDomain(domain, client, cfg, { server: opts.server })
+  if (!resolved.ok) return fromResolverFailure(command, resolved.result)
+  const { site, server } = resolved
+  onStage(`Site ${site.domain} on ${server.name} (${server.ip_address})`)
+
+  // A site that already has a local copy is not re-pulled: this engine only
+  // ever populates an empty directory, and re-syncing over an existing checkout
+  // would clobber local work. Refuse and say where the copy already is.
+  const existing = readLink(site.id)
+  if (existing) {
+    return fail(
+      "already_linked",
+      `${site.domain} already has a local copy at ${existing.path}.`,
+      "Pull the database into it with `spinuptui pull db`, or unlink it first (run `spinuptui`, select the site, press L then x).",
+    )
+  }
+
+  // Destination: the explicit argument, else derived as <localRoot>/<primary
+  // domain>, so an agent handed only a domain never has to invent a filesystem
+  // path. Only derived when there's exactly one root — with several configured
+  // there's no way to tell which one this site belongs in (they're commonly
+  // split by stack), and guessing would file a standard-WP site under Bedrock.
+  let dest = opts.path?.trim() ?? ""
+  if (!dest) {
+    if (cfg.localRoots.length === 0) {
+      return fail(
+        "no_dest",
+        "No destination path given, and no localRoots configured to derive one from.",
+        `Pass a path (\`spinuptui pull files ${domain} <path>\`), or set "localRoots": ["~/your/dev/dir"] in ${configPath()}.`,
+      )
+    }
+    if (cfg.localRoots.length > 1) {
+      return fail(
+        "ambiguous_dest",
+        `No destination path given, and ${cfg.localRoots.length} localRoots are configured (${cfg.localRoots.join(", ")}) — which one this site belongs in isn't knowable from here.`,
+        `Pass a path, e.g. \`spinuptui pull files ${domain} ${join(cfg.localRoots[0]!, site.domain)}\`.`,
+      )
+    }
+    dest = join(cfg.localRoots[0]!, site.domain)
+    onStage(`Destination derived from localRoots: ${dest}`)
+  }
+  const localUrl = opts.url?.trim() ?? ""
+
+  const planned = planLocalSetup(site, server, cfg.sshUser, dest, localUrl)
+  if (!planned.ok) {
+    const reason: PullReason = /isn't empty/i.test(planned.error) ? "dest_not_empty" : "plan_failed"
+    return fail(reason, planned.error)
+  }
+  const plan = planned.plan
+
+  onStage(
+    plan.isGit
+      ? `Source: git clone ${plan.repoUrl}`
+      : `Source: rsync ${plan.user}@${plan.host}:${plan.filesRoot}/ (excluding uploads and the caching drop-ins)`,
+  )
+  onStage(`Destination: ${plan.destPath}`)
+
+  let lastStage: LocalSetupStage | null = null
+  const result = await runLocalSetup(plan, (p) => {
+    if (p.stage !== lastStage && p.stage !== "done" && p.stage !== "error") {
+      lastStage = p.stage
+      onStage(`${FILES_STAGE_LABELS[p.stage]} …`)
+    }
+  })
+
+  if (result.stage === "error") {
+    const reason: PullReason = result.failedStage === "build" ? "composer_failed" : "fetch_failed"
+    return {
+      ...fail(reason, result.error ?? "The pull failed."),
+      ...(result.failedStage ? { failedStage: result.failedStage } : {}),
+    }
+  }
+
+  // Link it exactly as the TUI's guided clone does — `pull db` and the TUI's
+  // own `p`/`m` flows all key off this link.
+  await writeLink(site.id, { domain: site.domain, path: plan.destPath, localUrl })
+  onStage(`Linked ${site.domain} → ${plan.destPath}`)
+
+  const warnings: string[] = []
+  if (!localUrl) {
+    warnings.push(
+      `No local URL recorded. \`spinuptui pull db ${site.domain}\` needs one to rewrite production URLs — pass --url on the next run.`,
+    )
+  }
+  // The rsync path copies the site's real wp-config.php, which holds
+  // PRODUCTION's database credentials. Harmless in itself (SpinupWP's DB_HOST
+  // is localhost, so nothing local can reach the production database through
+  // it) but it means local wp-cli — and therefore `pull db` — authenticates as
+  // the production DB user against the local server and is denied. Say so here
+  // rather than letting it surface as a bare "Access denied" three steps later.
+  // The mirror image on the git path: Bedrock/Radicle keep DB credentials and
+  // WP_HOME in .env, which is deliberately NOT in the repo — so a fresh clone
+  // has none, and wp-cli runs with empty DB settings (`mysqldump: unknown
+  // variable 'pass='`). composer install having run is exactly the signal that
+  // this is such a checkout.
+  if (result.ranComposer && !existsSync(join(plan.destPath, ".env"))) {
+    warnings.push(
+      `No .env in the checkout — Bedrock/Radicle keep database credentials and WP_HOME there, and it isn't in the repo. Copy .env.example to .env and fill in DB_NAME / DB_USER / DB_PASSWORD / WP_HOME before running \`spinuptui pull db ${site.domain}\`.`,
+    )
+  }
+  if (!plan.isGit && existsSync(join(plan.destPath, "wp-config.php"))) {
+    warnings.push(
+      `${join(plan.destPath, "wp-config.php")} came from production and still holds its database credentials. Point DB_NAME / DB_USER / DB_PASSWORD / DB_HOST at your local database before running \`spinuptui pull db ${site.domain}\`.`,
+    )
+  }
+
+  return {
+    ok: true,
+    command,
+    domain,
+    primaryDomain: site.domain,
+    path: plan.destPath,
+    localUrl,
+    method: plan.isGit ? "git" : "rsync",
+    ranComposer: result.ranComposer === true,
+    linked: true,
+    ...(warnings.length ? { warnings } : {}),
+  }
+}
+
+export async function runPullDb(
+  domain: string,
+  opts: { url?: string | null; yes: boolean; server?: string | null },
+  client: SpinupWPClientLike,
+  cfg: AppConfig,
+  onStage: StageReporter,
+): Promise<PullDbResult> {
+  const command: PullCommand = "pull db"
+  const fail = (reason: PullReason, message: string, remedy?: string): PullFailure => ({
+    ok: false,
+    command,
+    domain,
+    reason,
+    message,
+    ...(remedy ? { remedy } : {}),
+  })
+
+  // Both gates first, before any network call: a wrong domain in a script
+  // should bounce off the confirmation, not off a fleet lookup.
+  if (!cfg.localSync) {
+    return fail(
+      "local_sync_disabled",
+      "Local database sync is disabled for this install.",
+      `Set "localSync": true in ${configPath()} (or export SPINUPWP_LOCAL_SYNC=1) to enable it.`,
+    )
+  }
+  if (!opts.yes) {
+    return fail(
+      "not_confirmed",
+      `This overwrites the local database for ${domain} with production's.`,
+      `Re-run with --yes once you're sure: \`spinuptui pull db ${domain} --yes\`.`,
+    )
+  }
+
+  onStage(`Resolving ${domain} …`)
+  const resolved = await resolveSiteByDomain(domain, client, cfg, { server: opts.server })
+  if (!resolved.ok) return fromResolverFailure(command, resolved.result)
+  const { site, server } = resolved
+
+  let link = readLink(site.id)
+  if (!link) {
+    return fail(
+      "not_linked",
+      `${site.domain} has no local copy linked, so there's nothing to import into.`,
+      `Run \`spinuptui pull files ${domain} <path> --url <local url>\` first.`,
+    )
+  }
+  // `--url` here doubles as "set the local URL and then sync", which is how a
+  // copy pulled without one becomes syncable without a detour through the TUI.
+  const url = opts.url?.trim()
+  if (url && url !== link.localUrl) {
+    link = { ...link, localUrl: url }
+    await writeLink(site.id, link)
+    onStage(`Local URL set to ${url}`)
+  }
+  onStage(`Local copy: ${expandPath(link.path)}`)
+
+  const planned = planDbSync(site, server, cfg.sshUser, link, new Date())
+  if (!planned.ok) {
+    return fail(
+      "plan_failed",
+      planned.error,
+      /local URL/i.test(planned.error) ? `Pass --url <local url> (e.g. \`spinuptui pull db ${domain} --url https://example.test --yes\`).` : undefined,
+    )
+  }
+  const plan = planned.plan
+
+  // Fail on the real cause rather than letting empty DB settings surface three
+  // steps later as `mysqldump: unknown variable 'pass='`.
+  if ((plan.localKind === "bedrock" || plan.localKind === "radicle") && !existsSync(join(plan.localRoot, ".env"))) {
+    return fail(
+      "missing_env",
+      `No .env in ${plan.localRoot} — this is a ${plan.localKind} checkout, so its database credentials live there and it isn't in the repo.`,
+      "Copy .env.example to .env and fill in DB_NAME / DB_USER / DB_PASSWORD / WP_HOME, then re-run.",
+    )
+  }
+
+  onStage(`Rewriting ${plan.remoteOrigin} → ${plan.localOrigin}`)
+  if (plan.prefixWarning) onStage(`Warning: ${plan.prefixWarning}`)
+  onStage(`A pre-import backup of the local database is written to ${plan.localBackupPath}`)
+
+  let lastStage: DbSyncStage | null = null
+  const result = await runDbSync(plan, site.domain, (p) => {
+    if (p.stage !== lastStage && p.stage !== "done" && p.stage !== "error") {
+      lastStage = p.stage
+      onStage(`${DB_STAGE_LABELS[p.stage]} …`)
+    }
+  })
+
+  if (result.stage === "error") {
+    const error = result.error ?? "The sync failed."
+    // Standard WP: the overwhelmingly likely cause right after `pull files` is the
+    // copied wp-config.php still carrying production's DB credentials, so local
+    // wp-cli authenticates as the production user against the local MySQL.
+    // Bedrock/Radicle keep credentials in .env instead (never pulled), and a
+    // DB_* variable exported in the shell can shadow that file.
+    const deniedAs = /access denied for user '([^']+)'/i.exec(error)?.[1]
+    const envBased = plan.localKind === "bedrock" || plan.localKind === "radicle"
+    return {
+      ...fail(
+        "sync_failed",
+        error,
+        !deniedAs
+          ? undefined
+          : envBased
+            ? `Local MySQL refused the user "${deniedAs}". This is a ${plan.localKind} checkout, so its database credentials live in ${join(plan.localRoot, ".env")} — point DB_NAME / DB_USER / DB_PASSWORD / DB_HOST there at your local database and re-run. A DB_* variable exported in your shell can override that file, so check \`env | grep ^DB_\` too.`
+            : `Local MySQL refused the user "${deniedAs}". If this copy came from \`pull files\`, its wp-config.php still holds production's database credentials — point DB_NAME / DB_USER / DB_PASSWORD / DB_HOST at your local database and re-run.`,
+      ),
+      ...(result.failedStage ? { failedStage: result.failedStage } : {}),
+    }
+  }
+
+  return {
+    ok: true,
+    command,
+    domain,
+    primaryDomain: site.domain,
+    path: expandPath(link.path),
+    localUrl: plan.localOrigin,
+    downloadPath: result.downloadPath ?? plan.downloadPath,
+    localBackupPath: result.localBackupPath ?? plan.localBackupPath,
+    ranHook: result.ranHook === true,
+    ...(plan.prefixWarning ? { warnings: [plan.prefixWarning] } : {}),
+  }
+}

package/src/lib/cliSsh.ts

@@ -5,9 +5,11 @@
 // trustworthy go/no-go rather than a guess.
 
 import type { AppConfig } from "../config.ts"
+import type { Server, Site } from "../api/types.ts"
 import type { SpinupWPClientLike } from "../api/client.ts"
 import { ApiError } from "../api/client.ts"
 import { resolveSiteSshTarget, SSH_OPTS } from "./probe.ts"
+import { spawn } from "./spawn.ts"
 
 export type SshAccessReason =
   | "no_token"
@@ -53,38 +55,44 @@ export type SshTargetResolution =
   | { ok: true; info: SshTargetInfo }
   | { ok: false; result: SshAccessResult & { ok: false } }
 
-// Domain -> site -> server -> SSH target/port, with no live connectivity check.
-// Split out of resolveSshAccess so callers that are about to run a real command
-// (which is itself a connectivity test) don't pay for a redundant probe first.
-export async function resolveSshTargetInfo(
+// A resolved domain, before anything is done with it. Shared by every
+// domain-addressed CLI command (`ssh`, `ssh-exec`, `pull`) so they all fail the
+// same way — same reason codes, same messages — on an unknown or ambiguous
+// domain, a rejected token, or a server with no IP.
+export type SiteResolution =
+  | { ok: true; site: Site; server: Server }
+  | { ok: false; result: SshAccessResult & { ok: false } }
+
+export async function resolveSiteByDomain(
   domain: string,
   client: SpinupWPClientLike,
   cfg: AppConfig,
-): Promise<SshTargetResolution> {
+  // Narrows an otherwise ambiguous domain to one server, by name — matching
+  // either the full name or its first label ("web1" for "web1.example.com"),
+  // which is what the ambiguity message itself prints. Callers that expose no
+  // way to pass it (ssh, ssh-exec) simply omit it and keep failing as before.
+  opts?: { server?: string | null },
+): Promise<SiteResolution> {
+  const fail = (
+    partial: Omit<SshAccessResult & { ok: false }, "ok" | "domain">,
+  ): SiteResolution => ({ ok: false, result: { ok: false, domain, ...partial } })
+
   if (!cfg.token) {
-    return {
-      ok: false,
-      result: { ok: false, domain, reason: "no_token", message: "No API token configured. Run `spinuptui login`." },
-    }
+    return fail({ reason: "no_token", message: "No API token configured. Run `spinuptui login`." })
   }
 
-  let site
-  let server
+  let site: Site
+  let server: Server
   try {
     const sites = await client.listSites()
     const matches = sites.filter(
       (s) => s.domain === domain || s.additional_domains?.some((a) => a.domain === domain),
     )
     if (matches.length === 0) {
-      return {
-        ok: false,
-        result: {
-          ok: false,
-          domain,
-          reason: "site_not_found",
-          message: `No site matching "${domain}" found in this SpinupWP account.`,
-        },
-      }
+      return fail({
+        reason: "site_not_found",
+        message: `No site matching "${domain}" found in this SpinupWP account.`,
+      })
     }
     if (matches.length > 1) {
       const candidates: SshAccessCandidate[] = await Promise.all(
@@ -93,48 +101,65 @@ export async function resolveSshTargetInfo(
           return { siteId: s.id, serverId: s.server_id, server: srv.name }
         }),
       )
-      return {
-        ok: false,
-        result: {
-          ok: false,
-          domain,
+      const wanted = opts?.server?.trim().toLowerCase()
+      const narrowed = wanted
+        ? candidates.filter((c) => {
+            const name = c.server.toLowerCase()
+            return name === wanted || name.split(".")[0] === wanted
+          })
+        : candidates
+      if (narrowed.length !== 1) {
+        return fail({
           reason: "multiple_matches",
-          message: `"${domain}" matches ${matches.length} sites in this account — cannot pick one automatically.`,
+          message: wanted
+            ? `"${domain}" matches ${matches.length} sites in this account, and ${narrowed.length === 0 ? "none are" : `${narrowed.length} are`} on a server matching "${opts?.server}".`
+            : `"${domain}" matches ${matches.length} sites in this account — cannot pick one automatically.`,
+          // Every command that resolves a domain takes --server, so this is
+          // always actionable — say so here rather than in each of them.
+          remedy: `Pick one with --server, e.g. \`--server ${candidates[0]!.server}\`.`,
           candidates,
-        },
+        })
       }
+      site = matches.find((m) => m.id === narrowed[0]!.siteId)!
+      server = await client.getServer(site.server_id)
+      return server.ip_address
+        ? { ok: true, site, server }
+        : fail({ reason: "server_has_no_ip", message: `Server "${server.name}" has no IP address on file.` })
     }
-    site = matches[0]
+    site = matches[0]!
     server = await client.getServer(site.server_id)
   } catch (err) {
     if (err instanceof ApiError && err.status === 401) {
-      return {
-        ok: false,
-        result: {
-          ok: false,
-          domain,
-          reason: "token_rejected",
-          message: "Saved API token was rejected (401) — it may be expired or revoked.",
-          remedy: "Run `spinuptui login` to save a fresh token.",
-        },
-      }
+      return fail({
+        reason: "token_rejected",
+        message: "Saved API token was rejected (401) — it may be expired or revoked.",
+        remedy: "Run `spinuptui login` to save a fresh token.",
+      })
     }
     const message = err instanceof ApiError ? err.message : `Unexpected error: ${(err as Error).message}`
-    return { ok: false, result: { ok: false, domain, reason: "api_error", message } }
+    return fail({ reason: "api_error", message })
   }
 
   if (!server.ip_address) {
-    return {
-      ok: false,
-      result: {
-        ok: false,
-        domain,
-        reason: "server_has_no_ip",
-        message: `Server "${server.name}" has no IP address on file.`,
-      },
-    }
+    return fail({ reason: "server_has_no_ip", message: `Server "${server.name}" has no IP address on file.` })
   }
 
+  return { ok: true, site, server }
+}
+
+// Domain -> site -> server -> SSH target/port, with no live connectivity check.
+// Split out of resolveSshAccess so callers that are about to run a real command
+// (which is itself a connectivity test) don't pay for a redundant probe first.
+export async function resolveSshTargetInfo(
+  domain: string,
+  client: SpinupWPClientLike,
+  cfg: AppConfig,
+  opts?: { server?: string | null },
+): Promise<SshTargetResolution> {
+  const resolved = await resolveSiteByDomain(domain, client, cfg, opts)
+  if (!resolved.ok) return resolved
+
+  const { site, server } = resolved
   const target = resolveSiteSshTarget(site, server, cfg.sshUser)
   const port = server.ssh_port && server.ssh_port !== 22 ? server.ssh_port : null
 
@@ -148,15 +173,16 @@ export async function resolveSshAccess(
   domain: string,
   client: SpinupWPClientLike,
   cfg: AppConfig,
+  opts?: { server?: string | null },
 ): Promise<SshAccessResult> {
-  const resolution = await resolveSshTargetInfo(domain, client, cfg)
+  const resolution = await resolveSshTargetInfo(domain, client, cfg, opts)
   if (!resolution.ok) return resolution.result
   const { primaryDomain, sshTarget: target, port, server: serverName } = resolution.info
   const portOpt = port ? ["-p", String(port)] : []
 
   let proc: ReturnType<typeof Bun.spawn>
   try {
-    proc = Bun.spawn(["ssh", ...SSH_OPTS, ...portOpt, target, "true"], {
+    proc = spawn(["ssh", ...SSH_OPTS, ...portOpt, target, "true"], {
       stdout: "pipe",
       stderr: "pipe",
       stdin: "ignore",

package/src/lib/cwdDotenv.ts

@@ -0,0 +1,106 @@
+// Keep the current directory's .env out of the processes we spawn.
+//
+// Bun auto-loads .env files from the directory it was launched in, and every
+// spawned child inherits process.env. Run spinuptui from inside a site's checkout
+// and that site's own .env — DB_NAME, DB_USER, DB_PASSWORD, WP_HOME — rides along
+// into `bash -lc "wp …"`. A Bedrock config then reads *nothing*: its phpdotenv
+// repository is immutable, so it skips keys that already exist in the
+// environment, while `Env::$options` with USE_ENV_ARRAY reads only $_ENV — which
+// PHP leaves empty for inherited variables when variables_order lacks "E" (the
+// Homebrew default). Every DB constant comes out blank, and `wp db export` fails
+// as "Access denied for user '<login name>'@'localhost' (using password: NO)".
+//
+// So: drop every key those files defined, except the ones this app reads itself —
+// its token and provider credentials may legitimately live in a project-local
+// .env (see config.ts). The provider keys have generic names a site's .env uses
+// too (Bedrock keeps S3 media credentials under AWS_*), so those are only trusted
+// from spinuptui's own project directory. Deleting from process.env only reaches children that are
+// handed process.env explicitly, which is what src/lib/spawn.ts is for. Must run
+// before anything reads config or spawns, which is why index.tsx imports this
+// module first.
+
+import { existsSync, readFileSync, realpathSync } from "node:fs"
+import { join } from "node:path"
+
+// Keys spinuptui reads from the environment on purpose. Only spinuptui uses the
+// SPINUP* names, so they're kept from any directory's .env.
+const OWN = /^SPINUP/
+
+// Provider credentials spinuptui also reads (config.ts). Kept only from the .env
+// in spinuptui's own project directory — anywhere else they're a site's keys.
+const PROVIDER = /^(CLOUDFLARE_API_TOKEN|AWS_(ACCESS_KEY_ID|SECRET_ACCESS_KEY|REGION)|GODADDY_API_(KEY|SECRET))$/
+
+// This file lives in <project>/src/lib.
+const PROJECT_DIR = join(import.meta.dir, "..", "..")
+
+function isProjectDir(dir: string): boolean {
+  try {
+    return realpathSync(dir) === realpathSync(PROJECT_DIR)
+  } catch {
+    return false
+  }
+}
+
+// Never removed, whatever a .env says: the spawned shells need these to work.
+const ESSENTIAL = new Set(["PATH", "HOME", "USER", "LOGNAME", "SHELL", "TMPDIR", "TERM", "LANG", "SSH_AUTH_SOCK", "XDG_CONFIG_HOME"])
+
+// The files Bun loads, in increasing precedence: .env, .env.<NODE_ENV> (default
+// development), then .env.local (skipped under test).
+function loadedFiles(cwd: string): string[] {
+  const mode = process.env.NODE_ENV || "development"
+  const names = [".env", `.env.${mode}`]
+  if (mode !== "test") names.push(".env.local")
+  return names.map((n) => join(cwd, n)).filter((p) => existsSync(p))
+}
+
+// Each key with the value the file gives it, or null where that value can't be
+// read with certainty (variable expansion, escapes, multi-line quotes). The value
+// only matters for telling a .env key from a shell one; see scrubCwdDotenv.
+export function dotenvEntries(text: string): Map<string, string | null> {
+  const out = new Map<string, string | null>()
+  for (const m of text.matchAll(/^[ \t]*(?:export[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*=(.*)$/gm)) {
+    out.set(m[1]!, dotenvValue(m[2]!.trim()))
+  }
+  return out
+}
+
+function dotenvValue(raw: string): string | null {
+  const q = raw[0]
+  if (q === "'" || q === "`" || q === '"') {
+    const end = raw.indexOf(q, 1)
+    if (end < 0) return null
+    const inner = raw.slice(1, end)
+    return q === '"' && /[$\\]/.test(inner) ? null : inner
+  }
+  const value = raw.replace(/\s+#.*$/, "").trim()
+  return value.includes("$") ? null : value
+}
+
+// Returns the keys removed, for tests and debugging.
+export function scrubCwdDotenv(cwd = process.cwd()): string[] {
+  // Later files win, as they do in Bun.
+  const entries = new Map<string, string | null>()
+  for (const file of loadedFiles(cwd)) {
+    let text: string
+    try {
+      text = readFileSync(file, "utf8")
+    } catch {
+      continue
+    }
+    for (const [key, value] of dotenvEntries(text)) entries.set(key, value)
+  }
+  const ownDir = isProjectDir(cwd)
+  const removed: string[] = []
+  for (const [key, value] of entries) {
+    if (OWN.test(key) || (ownDir && PROVIDER.test(key)) || ESSENTIAL.has(key) || !(key in process.env)) continue
+    // Bun never overrides a variable the shell already set, so a value that differs
+    // from the file's came from the shell — keep it. When the file's value can't be
+    // read with certainty, assume it's the file's and drop it.
+    if (value !== null && process.env[key] !== value) continue
+    delete process.env[key]
+    removed.push(key)
+  }
+  return removed
+}
+
+scrubCwdDotenv()